Authorizer

Whether CoSec authorizes every command and service route call of a request as its caller (CoSecCommandAuthorizer, <context>:<command> on <aggregate>/<id>), not only the public routes, where CoSec decides itself. A request-less command gets no objection. Off, and without a CommandAuthorizer of the application's, the command gateway allows every command that passed its route: behind a CoSec gateway, authorization is the gateway's.